Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
16 / 41 results
criticalbug_reportVulnerabilityRuby patches Onigmo regex RCE flaws exploited via GitLab untrusted input
Ruby versions 4.0.0–4.0.8, 3.4.0–3.4.11, and 3.3.0–3.3.12. Ruby 3.2 and earlier (EOL) will not receive patches. GitLab versions 7.0+ were affected; patched in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13.
criticalbug_reportVulnerabilityGitLab unauthenticated RCE vulnerability requires immediate patching
GitLab (specific versions not disclosed in available information). Vulnerability allows unauthenticated remote code execution. No CVE assigned yet or not publicly disclosed.
criticalbug_reportVulnerabilityGitLab patches max severity RCE flaw in Regular Expression Compiler
GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Vulnerability tracked as CVE-2026-110264. Over 2,700 GitLab CE instances exposed online.
criticalbug_reportVulnerabilityGitLab CVE-2026-110264: Unauthenticated RCE in CE/EE (CVSS 10.0)
GitLab Community Edition (CE) and Enterprise Edition (EE) versions 7.0 through 19.5.0. Specifically: 7.0–18.11.12, 19.0–19.0.9, 19.1–19.1.8, 19.2–19.2.8, 19.3–19.3.5, 19.4–19.4.2, and 19.5.0.
criticalbug_reportVulnerabilityGitLab CVSS 10.0 RCE affects all self-managed versions since 2014
GitLab self-managed installations versions 7.0 (2014) through 19.5.0. Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated already patched.
criticalbug_reportVulnerabilityGitLab CE/EE critical vulnerability requires immediate patching
GitLab Community Edition (CE) and Enterprise Edition (EE). Specific affected versions not disclosed in available advisory text. CVE identifier not yet assigned or published.
criticalbug_reportVulnerabilityGitLab CE/EE critical RCE (CVE-2026-97229) allows unauthenticated code execution
GitLab Community Edition (CE) and Enterprise Edition (EE) self-managed instances: versions before 19.4.2, before 19.3.4, and before 19.2.8. The critical vulnerability CVE-2026-97229 (CVSS 10.0) affects the CI/CD regular expression compiler.
criticalbug_reportVulnerabilityGitLab CI/CD regex compiler RCE allows unauthenticated code execution
GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. Self-managed instances are affected. GitLab.com and GitLab Dedicated are already patched.
criticalbug_reportVulnerabilityGitLab AI Gateway RCE flaw (CVE-2026-90970) affects self-hosted instances
GitLab AI Gateway versions 18.1.6 through 19.4.0 on self-hosted deployments. Authenticated users with Duo Agent Platform access can exploit. GitLab.com, GitLab Dedicated, and self-managed instances using GitLab-hosted gateways are NOT affected.
criticalbug_reportVulnerabilityGitLab AI Gateway critical RCE allows arbitrary command execution
GitLab AI Gateway service. Specific affected versions not disclosed in available information. Impacts organizations running GitLab instances with AI Gateway enabled.
criticalbug_reportVulnerabilityGitLab RCE vulnerabilities require immediate patching per CERT.BE
GitLab (specific versions not provided in advisory). Remote Code Execution vulnerabilities affect GitLab instances. CVE identifiers not specified in available information.
highbug_reportVulnerabilityGitLab issue email token enables code commits and CI/CD execution as user
GitLab.com (all accounts) and self-managed GitLab instances with incoming email enabled (default). GitLab Dedicated appears unaffected. All user roles affected, with impact severity scaling to account permissions (Guest minimal, Maintainer critical).
criticalbug_reportVulnerabilityGitLab CE/EE path traversal vulnerability requires immediate patching
GitLab Community Edition (CE) and Enterprise Edition (EE). Specific affected versions not disclosed in available information.
criticalbug_reportVulnerabilityGitLab CVSS 10.0 path traversal allows unauthenticated file read
GitLab Community Edition (CE) and Enterprise Edition (EE): all versions 18.7 to 19.1.7, 19.2.0 to 19.2.5, and 19.3.0 to 19.3.1. Requires at least one public project to exist on the instance.
criticalbug_reportVulnerabilityGitLab path traversal CVE-2026-85706 requires immediate patching
GitLab servers (specific affected versions not disclosed in available data). Path traversal vulnerability with maximum severity rating (CVSS 10.0 assumed).
criticalbug_reportVulnerabilityGitLab CVE-2026-19478 code injection under active exploitation
GitLab Community Edition (CE) and Enterprise Edition (EE): versions 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. Affects self-hosted instances with publicly accessible projects.